FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
Article Id 189625
This article describes how to dedicate an interface to management.

All FortiGate with mgmt, mgmt1 and mgmt2 interfaces.

Note: Management interfaces should be used for management traffic only. It is strongly advisable not to use them for processing general user traffic. Such use may adversely impact system stability.

The following command is designed to dedicate an interface to the management:
config system interface
edit mgmt2
set dedicated-to management
This feature is only available on models with mgmt, mgmt1 and mgmt2 interfaces and only applicable to those interfaces.

It prevents to create Firewall policy using an interface configured with this setting. It also allows to configure trusted host IP which overrides trusted host IP in the admin account.

A “connected’ route will be added to the VDOM routing table. Static or dynamic routes can also be added.

The following example shows mgmt2 configured as dedicated-to management :
FG-5KB-5140-E-7 # show system interface mgmt2
config system interface
edit "mgmt2"
set vdom "root"
set ip
set allowaccess ping fgfm
set type physical
set dedicated-to management   <--------
set snmp-index 14

It is not possible to create FW policy using mgmt2 :
FG-5KB-5140-E-7 (policy) # edit 2
new entry '2' added

FG-5KB-5140-E-7 (2) # set dstintf
<string> Please input string value
any Match any interface in the virtual domain.
virtual-wan-link Match the virtual WAN link in NAT mode.
base1 interface
base2 interface
fabric1 interface
fabric2 interface
mgmt1 interface
npu0-vlink0 interface
npu0-vlink1 interface
npu1-vlink0 interface
npu1-vlink1 interface
port1 interface
port2 interface
port3 interface
port4 interface
port5 interface
port6 interface
port7 interface
port8 interface

A “connected” route is automatically added to the routing table :
FG-5KB-5140-E-7 # get router info routing-table all
Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP
O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
* - candidate default

S* [10/0] via, mgmt1
C is directly connected, mgmt1
C is directly connected, mgmt2   <--------